Radio Frequency Identification Privacy Research Articles

Comparison and Feasibility of Various RFID Authentication Methods Using ECC.

Radio frequency identification (RFID) is a technology that has grown in popularity and in the applications of use. However, there are major issues regarding security and privacy with respect to RFID technology which have caught the interest of many researchers. There are significant challenges which must be overcome to resolve RFID security and privacy issues. One reason is the constraints attached to the provision of security and privacy in RFID systems. Along with meeting the security and privacy needs of RFID technology, solutions must be inexpensive, practical, reliable, scalable, flexible, inter-organizational, and long-lasting. To make RFID identifiers effective and efficient they must identify the item(s) while resisting attacks aimed at obtaining the tag’s information and compromising the system or making it possible to bypass the protection RFID tags are supposed to provide. Different authentication methods have been proposed, researched, and evaluated in the literature. In this work, we proposed our methodology in evaluating RFID authentication, and a few of the most promising authentication methods are reviewed, compared, and ranked in order to arrive at a possible best choice of protocol to use.

RFID Estimation With Blocker Tags

With the increasing popularization of radio frequency identification (RFID) technology in the retail and logistics industry, RFID privacy concern has attracted much attention, because a tag responds to queries from readers no matter they are authorized or not. An effective solution is to use a commercially available blocker tag that behaves as if a set of tags with known blocking IDs are present. However, the use of blocker tags makes the classical RFID estimation problem much more challenging, as some genuine tag IDs are covered by the blocker tag and some are not. In this paper, we propose RFID estimation scheme with blocker tags (REB), the first RFID estimation scheme with the presence of blocker tags. REB uses the framed slotted Aloha protocol specified in the EPC C1G2 standard. For each round of the Aloha protocol, REB first executes the protocol on the genuine tags and the blocker tag, and then virtually executes the protocol on the known blocking IDs using the same Aloha protocol parameters. REB conducts statistical inference from the two sets of responses and estimates the number of genuine tags. Rigorous theoretical analysis of parameter settings is proposed to guarantee the required estimation accuracy, meanwhile minimizing the time cost and energy cost of REB. We also reveal a fundamental tradeoff between the time cost and energy cost of REB, which can be flexibly adjusted by the users according to the practical requirements. Extensive experimental results reveal that REB significantly outperforms the state-of-the-art identification protocols in terms of both time efficiency and energy efficiency.

RFID Privacy Risk Evaluation Based on Synthetic Method of Extended Attack Tree and Information Feature Entropy

Evaluation of security risks in radio frequency identification (RFID) systems is a challenging problem in Internet of Things (IoT). This paper proposes an extended attack tree (EAT) model to identify RFID system's flaws and vulnerabilities. A corresponding formal description of the model is described which adds a probability SAND node together with the probability attribute of the node attack. In addition, we model the process of an RFID data privacy attack based on EAT, taking a sensitive information theft attack on an RFID tag as an example. To resolve the problem of assessing the risk probability of each node in EAT, we present the information feature entropy evaluation method for RFID privacy assessment. Finally, an evaluation is carried out to calculate the RFID privacy attack tree sequences and information feature entropy of the atomic node. Analysis shows that our scheme can calculate the overall risk evaluation result value for RFID privacy and comprehensively determine the risk of the weakest atomic node in RFID system.

Applications of RFID Technology [Book\/Software Reviews

This book is intended for radiofrequency identification (RFID) system designers, program managers, and regulators. It covers broad aspects of RFID requirements and RFID environments. The first chapter of this book offers an introduction to radiofrequency identification (RFID) history, applications, business applications, and standards. The remaining chapters focus on: radio-frequency spectrum and propagation, the theory of electromagnetism and Maxwell’s equations, near field, far field, and EH field; automatic identification systems (AISs; RFID standards, air interface, key players, and an example of an ultrahigh frequency (UHF) tags; RFID near-field and far-field propagation of low-frequency systems and high-frequency/microwave systems; RFID system design requirements; integrating RFIDs and sensor networks; and RFID market trends, barriers to RFID adoption, security, privacy, health risks, ethics, and moral dilemmas of RFID technology.

Traceability Analysis of Recent RFID Authentication Protocols

Radio frequency identification (RFID) technology is a prominent technology which has been used in most authentication and identification applications. Above all, recently RFID systems have got more attention as an interesting candidate to implement in the internet of things systems. Although RFID systems provide useful and interest services to users, they can also threat the security and the privacy of the end-users. In order to provide the security and the privacy of RFID users, different authentication protocols have been proposed. In this study, we analyze the privacy of three RFID authentication protocols that proposed recently. For our privacy analysis, we use a formal RFID privacy model which proposed by Ouafi and Phan. It is shown that the privacy of all the analyzed protocols have some problems and cannot provide user privacy. Then, in order to keep and protect the privacy of RFID users, two improved versions of analyzed protocols are proposed which overcome all the existing weaknesses. Our privacy analysis show that privacy of improved protocols are complete and they are resistance against different traceability attacks such as traceability, backward traceability and forward traceability attacks. In addition, the privacy of the proposed protocols, analyzed protocols and some similar protocols is compared.

Securing Low-cost RFID Systems: A Research Survey

RFID (Radio Frequency IDentification) technology has moved from academic obscurity into mainstream business and practice. Although this technology has many catching and exclusive characteristics, security and privacy issues associated are not easy to address due to tags’ modest computational and storage capabilities and the necessity to keep their prices low. This paper provides a general overview of the rather broad area of RFID security and privacy and gives the main citations for the comprehensive understanding and further explorations of this area. To be specific, previous attempts to enable or increase the security and privacy of the low-cost RFID systems are examined, including: (1) design and cryptanalysis of lightweight ciphers; (2) privacy-preserving authentication protocols and their designing requirements; and (3) non-conventional solutions leveraging physical characteristics of RFID tags or physical layer of the tag-reader communication for security and privacy purposes.

A Hash Function-Based RFID Authentication Protocol

The Radio Frequency Identification (RFID) is an automatic identification system, which is widely used for industrial and individual applications. Evolvement and benefits of RFID technology signifies that it can be low-cost, efficient and secured solution to many pervasive applications. However, features of RFID systems present potential security and privacy problems. The ensuring strong privacy has been an enormous challenge due to extremely inadequate computational storage of typical RFID tags. In an effort to resolve these problems and protect the users from tracing and to support Low-cost RFID, in this paper, we propose an RFID security method that achieves all requirements based on a hash function and a symmetric key cryptosystem. In addition, our proposed method provides not only high-security but also high-efficiency.

PUF-enhanced offline RFID security and privacy

RFID (Radio Frequency IDentification) based communication solutions have been widely used nowadays for mobile environments such as access control for secure system, ticketing systems for transportation, and sport events. These systems usually depend on readers that are not continuously connected to a secure backend system. Thus, the readers should be able to perform their duties even in offline mode, which generally requires the management by the readers of the susceptible data. The use of RFID may cause several security and privacy issues such as traceability of tag owner, malicious eavesdropping and cloning of tags. Besides, when a reader is compromised by an adversary, the solution to resolve these issues getting worse. In order to handle these issues, several RFID authentication protocols have been recently proposed; but almost none of them provide strong privacy for the tag owner. On the other hand, several frameworks have been proposed to analyze the security and privacy but none of them consider offline RFID system. Motivated by this need, in this paper, we first revisit Vaudenay's model, extend it by considering offline RFID system and introduce the notion of compromise reader attacks. Then, we propose an efficient RFID mutual authentication protocol. Our protocol is based on the use of physically unclonable functions (PUFs) which provide cost-efficient means to the fingerprint chips based on their physical properties. We prove that our protocol provides destructive privacy for tag owner even against reader attacks.

Critical Evaluation of RFID Security Protocols

Radio Frequency Identification (RFID) system is a low-cost contactless automatic identification technology; and barcode as a traditional technology is now broadly replaced by RFID systems to make objects more manageable in supply chains and other enterprises. This technology is operational in open wireless communication spaces whereby its transmission signals can be easily accessed resulting in security problems. Consequently, it becomes an absolute necessity to develop efficient security protocols to protect the data against various attacks. This paper outlines a critical evaluation of the RFID systems, the security and privacy issues in the RFID security protocols, the EPCglobal Class-1 Generation-2 standard as it is an international standard, its lower cost of implementation, and high speed data transmission and operation.

Unbalanced states violates RFID privacy

Designing privacy preserving authentication protocols for massively deployed Radio Frequency IDentification (RFID) systems is a real world challenge that have drawn significant attention from RFID community. This interest yields considerable amount of proposals targeting to overcome the main bottleneck (i.e. the exhaustive search over the list of all tag entries) which appears in the back-end database for large-scale RFID tag deployments. A class of these proposals contains RFID protocols where the server authenticates the tag in a negligible constant/sub-linear time for a more frequent normal state and needs a linear search in a rare abnormal states. In this study, however, we show that such protocols having unbalanced states are subject to side-channel attacks and do not preserve the RFID privacy. To illustrate this brutal security flaw, we conduct our analysis on different RFID protocols.

Vulnerabilities in Chen and Deng's RFID mutual authentication and privacy protection protocol

As incorporation of RFID (Radio Frequency IDentification) tags in a wide variety of applications increase, there is a need to ensure the security and privacy of the entity to which these tags are attached. Not surprisingly, this is a very active area as attested by the large number of related published research literature. Recently, the journal engineering applications of artificial intelligence published a paper by Chen and Deng (2009) where the authors propose a mutual authentication protocol for RFID. This protocol has fundamental flaws that can be readily taken advantage by a resourceful adversary. We identify and discuss these vulnerabilities and point out the characteristics of this protocol that exposes it to these vulnerabilities.

Survivability Enhancing Techniques for RFID Systems

Radio Frequency Identification (RFID) has been applied in various high security and high integrity settings. As an important ubiquitous technique, RFID offers opportunities for real-time item tracking, object identification, and inventory management. However, due to the high distribution and vulnerability of its components, an RFID system is subject to various threats which could affect the system’s abilities to provide essential services to users. Although there have been intensive studies on RFID security and privacy, there is still no complete solution to RFID survivability. In this paper, the authors classify the RFID security techniques that could be used to enhance an RFID system’s survivability from three aspects, i.e., resilience, robustness and fault tolerance, damage assessment and recovery. A threat model is presented, which can help users identify devastating attacks on an RFID system. An RFID system must be empowered with strong protection to withstand those attacks and provide essential functions to users.

RFID Privacy Issues in Healthcare: Exploring the Roles of Technologies and Regulations

AbstractWith the deployment and use of Radio Frequency Identification (RFID) technology in the healthcare domain, there are increasing privacy concerns regarding the technical designs of RFID systems vis-a-vis the requirements of the healthcare regulations. This paper reviews and analyzes the impact of privacy issues in the RFID adoption in the healthcare domain, and presents a conceptual framework for analyzing the relationship between technology and regulations in light of the Fair Information Practice (FIP) principles to ensure patients’ privacy. Our conceptual framework uses the FIP principles as a guideline to examine the design of Privacy Enhancing Technologies (PETs) and analyze existing regulations to assess the compliance issues. The conceptual analyses show that current PETs fail to incorporate the FIP principles and thus organizations in the healthcare sector face complex challenges to comply with security and privacy standards and regulations. Using the groundwork laid down in this study, futu...

RFID and Consumer Privacy

ABSTRACT The increasing use of radio frequency identification (RFID) technology applications brings potential to create profound implications for customer relationships, namely consumer privacy. RFID provides many benefits to both consumers and businesses engaged in traditional and Internet commerce, however, there exist privacy concerns generated by the current and potential use of the technology. This article discusses such concerns, as well as potential misuse of RFID and ways in which proposed and pending legislation could address consumer privacy issues.

Protecting Your Privacy with a Mobile Agent Device in RFID Environment

Radio Frequency Identification (RFID) Technology is a contactless automatic identification technology using radio frequency. For this RFID technology to be widely spread, the problem of privacy invasion should be solved. There are many research works in progress to solve the RFID privacy problems. Most of works for solving this problem have focused on developing light-weight cryptographic modules which can be embedded into RFID tags, but some of them used a proxy agent approach that control communications between the tag and the reader for protecting user privacy. The later approach is very useful and practical in terms of manufacturing low-cost tag hardware. However, all schemes of this approach have some problems in ownership transfer and forgery detection. In this paper, we are focusing on the proxy agent approach and we suggest an advanced agent scheme that guarantees not only privacy protection but also forgery detection. And our scheme is more scalable than other agent schemes so far.

A Low Cost Key Agreement Protocol Based on Binary Tree for EPCglobal Class 1 Generation 2 RFID Protocol

There are many protocols proposed for protecting Radio Frequency Identification (RFID) system privacy and security. A number of these protocols are designed for protecting long-term security of RFID system using symmetric key or public key cryptosystem. Others are designed for protecting user anonymity and privacy. In practice, the use of RFID technology often has a short lifespan, such as commodity check out, supply chain management and so on. Furthermore, we know that designing a long-term security architecture to protect the security and privacy of RFID tags information requires a thorough consideration from many different aspects. However, any security enhancement on RFID technology will jack up its cost which may be detrimental to its widespread deployment. Due to the severe constraints of RFID tag resources (e.g., power source, computing power, communication bandwidth) and open air communication nature of RFID usage, it is a great challenge to secure a typical RFID system. For example, computational heavy public key and symmetric key cryptography algorithms (e.g., RSA and AES) may not be suitable or over-killed to protect RFID security or privacy. These factors motivate us to research an efficient and cost effective solution for RFID security and privacy protection. In this paper, we propose a new effective generic binary tree based key agreement protocol (called BKAP) and its variations, and show how it can be applied to secure the low cost and resource constraint RFID system. This BKAP is not a general purpose key agreement protocol rather it is a special purpose protocol to protect privacy, un-traceability and anonymity in a single RFID closed system domain.

Practical Minimalist Cryptography for RFID Privacy

The fear of unauthorized, hidden readouts has dominated the radio frequency identification (RFID) privacy debate. Virtually all proposed privacy mechanisms so far require consumers to actively and explicitly protect read access to their tagged items-either by jamming rogue readers or by encrypting or pseudonymizing their tags. While this approach might work well for activists and highly concerned individuals, it is unlikely (and rather undesirable) that the average consumer should be outfitted with RFID jamming devices before stepping outside, or that anyone would bother pseudonymizing every can of soda they buy with a personal PIN code. Juels' ldquominimalist cryptographyrdquo offers a simple, yet effective, identification and tracking protection based on simple ID rotation, but it requires that the corresponding mappings (i.e., from pseudonyms to real IDs) are electronically exchanged whenever a product changes hands (e.g., for buying a pack of chewing gum at a kiosk)-a rather impractical requirement. Our work extends Juels' concept in order to alleviate the need for passing ID mapping tables. Using carefully assembled sets of IDs based on the cryptographic principle of secret shares, we can create RFID tags that yield virtually no information to casual ldquohit-and-runrdquo attackers, but only reveal their true ID after continuous and undisturbed reading from up-close-something that can hardly go unnoticed by an item's owner. This paper introduces the underlying mechanism of our extension to Juels' proposal, called ldquoShamir Tag,rdquo analyzes its tracking resistance and identification performance, and discusses deployment aspects.

A Simple Privacy Protecting Scheme Enabling Delegation and Ownership Transfer for RFID Tags

RFID (Radio frequency identification) technology raises many privacy concerns among which the potential tracking of an RFID tag bearer and the eventuality of an illegitimate reading device (reader) collecting information about him. To solve these issues, many RFID privacy protecting protocols assume that readers have continuous connectivity with a centralised on-line database in charge of the identification of a certain amount of tags. However such centralised models can raise scalability and latency problems. Moreover, they are not suitable in applications where connectivity is intermittent. As RFID tags may often change hands, it is also necessary to guarantee the privacy of a new tag owner. In this paper, we introduce a privacy protecting scheme based on pseudonyms that allows an online database to delegate temporarily and in a secure manner the capability to identify tags to selected readers. A reader which receives delegation for a given tag can identify this tag without referring to the on-line database, thus solving possible intermittent connectivity issues and making tag identification more scalable. Our protocol also manages tags ownership transfer without threatening the new owner’s privacy.

RFID systems, standards and privacy within libraries

PurposeThe goal of this paper is to provide an overview of the perceived threats of radio frequency identification (RFID) systems in libraries, to probe their technical feasibility and to present a clear picture of what may and may not be done by libraries to mitigate the risk that actually exists.Design/methodology/approachThe current RFID standards are examined in the context of privacy and their limitations are weighed.FindingsThe paper finds that current standards do not offer a platform for secure RFID systems and have several vulnerabilities that may permit privacy compromising activities and acts of digital vandalism. It suggests that libraries need to be aware of these.Research limitations/implicationsThe RFID application space is vast and spans multiple technology platforms and standards of which libraries are but a small part. Observations made regarding one application are not necessarily valid in another application.Practical applicationsThe paper shows what could be done in the future by commercial RFID vendors to maintain compatibility with standards while maximising the data security and therefore borrower privacy of their systems.Originality/valueNo subject has so polarised libraries in recent years as the potential risk to personal privacy brought about by the introduction of RFID systems. It can be extremely difficult for libraries to accurately gauge the risks to the privacy of their borrowers in the context of rhetoric, which at times borders on the hysterical and is often misinformed. The paper addresses the myths and misconceptions and raises awareness of the issues.

RFID security and privacy: a research survey

This paper surveys recent technical research on the problems of privacy and security for radio frequency identification (RFID). RFID tags are small, wireless devices that help identify objects and people. Thanks to dropping cost, they are likely to proliferate into the billions in the next several years-and eventually into the trillions. RFID tags track objects in supply chains, and are working their way into the pockets, belongings, and even the bodies of consumers. This survey examines approaches proposed by scientists for privacy protection and integrity assurance in RFID systems, and treats the social and technical context of their work. While geared toward the nonspecialist, the survey may also serve as a reference for specialist readers.